To comply with a regulation, you must declare the actions to be implemented within your organization and then prove that you are doing so. Tenacy distinguishes several steps to achieve this.
Declare your security baseline across your perimeters
This allows you to assess the current state of your organization and declare which measures are in place or missing. It marks the starting point for creating your action plan.
View from the actual security base:
View from the new security base:
Create compliance implementation action plans
Your action plan begins when you declare your baseline, particularly by adding implementation actions (everything your organization lacks to be compliant), or improvement actions for elements that are not fully implemented or controlled (especially where you have no documentation management in place).
We recommend breaking down your actions into subtasks, especially for the measures you need to implement.
Example: If you need an Information Security Policy (ISP), the action can be broken down as follows:
Drafting: Someone writes it
Review: Someone reviews it
Approval: Someone approves it
➡️ This serves as proof for audits, as it provides traceability (notably via the activity tab). Moreover, it ensures easy access to evidence during the audit since everything is included within a single action.
Create a register of recurring tasks
This demonstrates that “things are running”: once actions are completed, you set up controls where you also collect evidence.
Example:
Annual update of the Information Security Policy (recurring annual task).
The same approach applies to measures already implemented—you use these controls to prove that they are already in place in the organization.
In general, the audit takes place between the action plan and the recurring tasks.
Conduct an internal audit: create a non-conformity register
This audit is where you identify minor and major non-conformities.
After this audit, you can log these non-conformities as "gaps" in Tenacy to track their resolution.
How to handle these gaps?
By linking actions to them. This allows you once again to attach evidence—for example, for your future surveillance audit—to prove that you’ve addressed past non-conformities.
💡 During the planning audit, there should be no actions with the status “To be planned,” as this would suggest the issue hasn’t been addressed. Everything must be at least in the “Planned” status with a start date. This demonstrates control.
Create a monitoring dashboard
To make your daily work easier—and help the auditor on audit day—you can visualize the progress of your work in a dashboard.